How secondary DNS works
A secondary server transfers an existing authoritative zone from its primary server and answers queries from that copy. It does not create records, replace the primary or change registrar delegation. The primary remains the source of truth and must notify or permit transfers to the secondary.
Prepare the primary zone
Confirm the primary IPv4 address answers authoritatively for the domain, the SOA serial increases after every change and zone-transfer policy permits the secondary service. Correct any split-horizon or firewall rule that prevents the public secondary from reaching TCP and UDP port 53.
Add and verify the zone
Under Secondary DNS, add the domain and primary server address. Wait for the first transfer, then compare SOA serials and representative A, AAAA, MX and TXT answers directly against both authoritative servers. Add the secondary nameserver to public delegation only after those answers match.
Change the primary address
Update the configured primary IPv4 address only after the new primary serves a complete current zone and permits transfers. Confirm the secondary receives the new serial before retiring the old address.
Remove secondary DNS
First remove the secondary nameserver from domain delegation and wait for cached delegation to expire. Verify another authoritative path remains available, then remove the secondary zone. Deleting the secondary while it is still delegated can produce intermittent resolution failures.
